1/12 




FIG. 1 



3/12 



CD 
-J 



ct ^ 

Uj CD 

c3 ^ 

CD Qc 

3S 



I 

CC CD 
Mj ^ CQ 
CD Cr Q 
CD O T - 
O fc- v - 

CO 



CD 
CD 
O 



CD 

Uj Uj 

as 



3 

CD CD 



CD 



CD 
CO 



s 

1 



I 

CD 



cSP 

CD 

o 

CD k~ 

P 

co 



^ ^ r> 

CD g 

CO 
CO 



C*3 

5: 



4/12 



NETWORK 
APPLICATION 
PUBLISHING 
MESSAGES 



210A 



\ 



1 



-203A 



MESSAGELOGGER 
MASTERTHREAD 
SCANS FOR NEW 

AGENT THREADS TO 
CREATE 



-203B 



210B 



<A)s 200 

~© 210C 
r 203C 



MESSAGELOGGER 
MASTERTHREAD 
SCANS FOR NEW 

AGENT THREADS TO 
CREATE 



-205 



CAPTURING AGENT 
LISTENING FOR ALL 
MESSAGES 



MESSAGELOGGER 
MASTERTHREAD 
SCANS FOR NEW 
AGENT THREADS TO 
CREATE 




STORE EXTRACTED 
DATA ON DATABASE 
QUEUE OBJECT UNTIL 
QUEUE IS FULL 



215 



NETWORK 
MONITORING AGENT 
LISTENING FOR ALL 
MACHINE SPECIFIC 

MESSAGES 



EXTRACT NETWORK 
DATA FROM 
MESSAGE 



-218 



I 



209 



ONCE QUEUE IS 
FULL COMMIT ALL 

DATA TO 
DATABASE AND 
CONTINUE TO 
USTEN FOR MORE 
MESSAGES 



AS MESSAGES 
ARRIVE, STORE THEM 
ON DATABASE QUEUE 
OBJECT UNTIL QUEUE 
IS FULL 



7\ 



-219 



J 



I 



I ONCE QUEUE IS 
FULL COMMIT ALL 

DATA TO 
DATABASE AND 
CONTINUE TO 
LISTEN FOR MORE 
MESSAGES 




AGENT LISTENING 
FOR ALL NETWORK 
MESSAGES 



I 



223 



COUNT THE NUMBER 
OF MESSAGES 
RECEIVED IN 1 
SECOND 



225 



COMPARE TO 

DEFAULT 
THREASHOLD 



226 



AS MESSAGES 
ARRIVE, STORE THEM 
ON DATABASE QUEUE 
OBJECT UNTIL QUEUE 
IS FULL 



7\ 



I 



FIG. 4A 



r 228 

ONCE QUEUE IS l\ 



FULL COMMIT ALL 

DATA TO 
DATABASE AND 
CONTINUE TO 
LISTEN FOR MORE 
MESSAGES 



<2> 



5/f2 



LZ 



203F 



210F 



-203D 



210D 



MESSAGELOGGER 
MASTERTHREAD 
SCANS FOR NEW 
AGENT THREADS TO 
CREATE 



-235 



1 



TRACKING 
MONITORING AGENT 
LISTENING FOR ALL 
NETWORK MESSAGES 



-237 



1 



IDENTIFY SOURCE 
ADDRESS OF EACH 
MESSAGE SENT. 
ADD TO DATABASE 
QUEUE 



1 



-238 



/ AS MESSAGES ^ 
ARRIVE, STORE THEM 
ON DATABASE QUEUE 
OBJECT UNTIL QUEUE 
\ IS FULL 



-239 



ONCE QUEUE IS 
FULL COMMIT ALL 
DATA TO 

DATABASE AND 
CONTINUE TO 
LISTEN FOR MORE 
MESSAGES 



1 



I 



FIG. 4B 



MESSAGELOGGER 
MASTERTHREAD 
SCANS FOR NEW 

AGENT THREADS TO 
CREATE 



/ 



-245 



1 



ALERT 

MONITORING AGENT 
LISTENING FOR ALL 
NETWORK MESSAGES 



-246 



SCAN THE CONTENTS 
OF THE MESSAGE PER 
THE RULES DEFINED 

BY THE USER 

INTERFACE. 

IF THE CONTENTS OF 

THE MESSAGE 
MATCHED THE ALERT 
RULES, ADD TO 
DATABASE QUEUE 



-248 



1 



AS MESSAGES 
ARRIVE, STORE THEM 
ON DATABASE QUEUE 
OBJECT UNTIL QUEUE 
ISFULL 



1 



-249 



ONCE QUEUE IS 
FULL COMMIT ALL 

DATA TO 
DATABASE AND 
CONTINUE TO 
LISTEN FOR MORE 
MESSAGES 



71 



210E 



/ 

-251 



NEW SUBJECT 
MONITORING AGENT 




DISCARD 



-258 



r 



STORE NEW 
SUBJECTS ON 
DATABASE QUEUE 
OBJECT UNTIL QUEUE 
IS FU LL \l 



-259 



ONCE QUEUE IS 
FULL COMMIT ALL 

DATA TO 
DATABASE AND 
CONTINUE TO 
LISTEN FOR MORE 
MESSAGES 



200 



\ 



c 



START 



j-301 



6/12 



LOADED 
CONFIGURATION 
SETTINGS FROM DATA 
FILE 



r 



303 



CREATE LOG FILE TO 
OUTPUT EVENTS TO 
FILE 



JL 



304 



START MONITORING 
MODULE TO CHECK 
THE HEALTH OF THE 
APPLICATION WHILE 
RUNNING 



I 



JL 



306 



CHECK IF OTHER 
AGENTS EXIST ON 
THE NETWORK, IF SO 
INFORM THE USER 
AND QUIT 



110E 



307 



& 



INITIALIZE NEW 
SUBJECT MONITOR 
AGENT MODULE TO 

LISTEN FOR NEW 
SUBJECTS ON THE 



JL 



309 



OPEN DATABASE 

CONNECTION POOL 
MODULE TO BE 
PROVIDED TO 
MODULES WHICH 
REQUIRE ACCESS TO 
THE DATABASE 



JL 



310 



LOAD ROUTINES TO 

CHECKFOR 
APPLICATION HEALTH 



READ APPLICATION 



PARAMETERS FROM 
DATABASE 



JL 



FOR EACH 
APPLICATION IN 
DATABASE. IDENTIFY 
TYPE OF AGENT 



JL 



IF APPLICATION TYPE 
IS "C" CHECK IF 
APPLICATION IS 
ALREADY RUNNING. 
IF APPLICATION IS 
RUNNING, KILL THE 
APPLICATION, OBTAIN 
A NEW THREAD AND 
RE-STARTIT 



JL 



312 



314 



315 



318 



IF APPLICATION TYPE 
IS "N" CHECK IF 
APPLICATION IS 
ALREADY RUNNING. 
IF APPLICATION IS 
RUNNING, KILL THE 
APPLICATION, OBTAIN 
A NEW THREAD AND 
RE-STARTIT 



v _r322 



IF APPLICATION TYPE 
IS "S" CHECK IF 
APPLICATION IS 
ALREADY RUNNING. 
IF APPLICATION IS 
RUNNING, KILL THE 
APPUCATION, OBTAIN 
A NEW THREAD AND 
RE-STARTIT 



■} f 326 K 



OBTAIN A NEW 
DATABASE 
CONNECTION FROM 
POOL 



110A 



r328 



CAPTURE AGENT 
FROM ■ 
CONFIGURATION 
OBTAINED FROM 



JL 



329 



USTENFORALL 



MESSAGES 
RECEIVED ON THE 



SPECIFIED BY 
DATABASE SETTINGS 



JL 



331 



ARRIVE, RETRIEVE THE 
SUBJECT, SIZE, DATE, 



MESSAGE SOURCE 



I 



JL 



333 



RECEIVED TO 
DATABASE 
BATCH OBJECT 



JL 



334 



WHEN BATCH IS 
FULL COMMIT ALL 
DATA TO DATABASE 



FIG. 5A 



FIG. 5B 



7/12 



OBTAIN A NEW 
DATABASE 
CONNECTION FROM 
POOL 



11 OB 



■336 



200 



-338 



-346 



INITIALIZE NEW 
NETWORK 
TRACKING 
AGENTFROM 

CONFIGURATION 



DATABASE 



I 



OBTAIN A NEW 
DATABASE 
CONNECTION 
FROM POOL 



11 oc 



-339 



LISTEN FOR ALL 
NODE SPECIFIC 

MESSAGES 
RECEIVED ON THE 

PARAMETERS 
SPECIFIED BY 
DATABASE 
SETTINGS 



I 



349 



J2 



341 



WHEN MESSAGES 
ARRIVE, RETRIEVE 
THE NETWORK 
PARAMETERS 
FROM MESSAGE 



342 



ADD MESSAGE 
PARAMETERS 
RECEIVED TO 
DATABASE 

BATCH OBJECT 



£344 



WHEN DATABASE 

BATCH IS 
FULL, COMMIT ALL 
DATA TO DATABASE 



INITIALIZE NEW 

STORM 
MONITORING 
AGENTFROM 
CONFIGURATION 
OBTAINED FROM 
DATABASE 



£_ 



351 



LISTEN FOR ALL 

MESSAGES 
RECEIVED ON THE 
PARAMETERS 
SPECIFIED BY 
DATABASE 
SETTINGS 



\ r 35 3 



WHEN MESSAGES 
ARRIVE, DETERMINE 
MESSAGE ARRIVAL 

RATE 
ACCELLERATION 
AND/OR ANY 
OTHER STATISTICAL 
PARAMETERS 



i r 



355 



DEPENDING 
ON RATE 
ACCELLERATION 
AND OR 
STATISTICAL 
PARAMETERS, 
GENERATE SIGNAL 



£351 



WHEN 
BATCH IS 
FULL, COMMIT ALL 
DATA TO DATABASE 




1 



NEW SUBJECT 
MONITORING AGENT 



I 



FIND 
LAST RECORD 
IN THE DAILY 
DATABASE AND 
STORE VALUE IN 
MEMORY 



SCAN DAILY AND 
SUBJECT CACHE 
TABLES FOR THE 
EXISTENCE OF NEW 
SUBJECTS STARTING 
AFTER LAST RECORD 



LAST RECORD 

+ 1AND 
STORE VALUE 



8/12 



-362 



■364 



-369 




SAVE NEW SUBJECT 
TO DATABASE INTO 
THE SUBJECT 
CACHED TABLE 



-390 



£ 



SAVE NEW SUBJECT 
TO DATABASE INTO 
THE NEW SUBJECT 
TABLE 



FIG. 6 



■391 



SEND ALERT TO 
ADMINISTRATOR 
THAT A NEW 

SUBJECT HAS BEEN 
DETECTED 



-393 



9/12 











k 




k 


k 


FOR EACH EVENT / 

MESSAGE IS 
RECEIVED, CHECK IF 
- FIELD NAME EXISTS 
SPECIFIED IN 
CONFIGURATION 
PARAMETERS 





IF FIELD NAME 
EXISTS, EXTRACT 
VALUE 




COMPARE VALUE TO 
USER CRITERIA OF 
(IS VALUE >,>=,= 
<,< = OR <> 
THAN CRITERIA 







\ 




CO 
UjUjUj 



.03. 




10/12 




8 




11/12 



( START ) 



I 



LOAD 
CONFIGURATION 
SETTINGS FROM DATA 
FILE 



I 



CREATE LOG FILE TO 
OUTPUT EVENTS TO 
FILE 



I 



START MONITORING 
MODULE TO CHECK 
THE HEALTH OF THE 
APPLICATION WHILE 
RUNNING 



I 



CHECK IF OTHER 
AGENTS EXIST ON 
THE NETWORK, IF SO 
INFORM THE USER 
AND QUIT 



I 



OPEN DATABASE 
CONNECTION POOL 
MODULE TO BE 
PROVIDED TO 
MODULES WHICH 
REQUIRE ACCESS TO 
THE DATABASE 



LOAD ROUTINES TO 

CHECK FOR 
APPLICATION HEALTH 



-301 



-303 



■304 



306 



-309 



-310 



CREATE NEW 
INSTANCE OF 
MODULE WITH 
PARAMETERS 
RETRIEVED FROM 
DATABASE 



INITIALIZE NETWORK 
VENDOR SPECIFIC 
LIBRARIES FOR TCP! 
IP PROTOCOLS 



CREATE 
NETWORK LISTENER 
FOR SPECIFIC 

PARAMETERS FROM 
DATABASE 



WHEN RECEIVING A 
VENDOR SPECIFIC 
MESSAGE, EXTRACT 

SUBJECT AND 
SOURCE MACHINE 
NAME AND ADDRESS 



ADD TO THE 
APPLICATION QUEUE 
THE PARAMETERS 
EXTRACTED 



/ 



11 OF 



-450 



-451 



-453 



-455 



457 



WHEN QUEUE IS 
FULL, SAVE THE 
CONTENTS OF THE 
QUEUE TO THE 
DATABASE FOR 
PERMANENT 
STORAGE 



-459 



FIG. 8 



12/12 




/ 



